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jiPROBLEM TO BE SOLVED: To prevent the execution of a 
^ program dangerous to a user and a system, such as a virus 

infected program and a maliciously created program. 
.. SOLUTION- Prior to installation or starting up of a plug"4n, 
l a function list showing unit 200a thereof shows to an 
[ application to be a host a list of functions (services) to be 

[ used by acquiring from the host. When a dangerous function 

i: 

j; (erasing a file, etc.), specified in advance in the list is 
[ included, a security management unit 201a of the host asks 
j the user whether or not to still continue the 

I: 

{ installation/starting-up by an execution inquiry unit 20 Id. 
I'^Also, during a plug-in execution, whether or not to continue 
j the execution of the plug-in is inquired at any time when an 
actually requested function is not shown in the above list. 
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CLAIMS 



[Claim(s)] 

[Claim l] A judgment means to judge whether the function specified by said assignment means is 
included in an assignment means by which a user's permission specifies a required fiinction as the 
activation, and the fimctional Usting shown firom the program. The program execution arrester 
characterized by having an inquiry means to ask a user whether install said program when judged 
with said specified fiinction being included in said fimctional listing by said judgment means. 
[Claim 2] A judgment means to judge whether the fiinction specified by said assignment means is 
included in an assignment means by which a user's permission specifies a required fiinction as the 
activation, and the fimctional listing shown from the program, The program execution arrester 
characterized, by having an inquiry means to ask a user whether start said program when judged 
with said specified fiinction being included in said fimctional listing by said judgment means. 
[Claim 3] The 1st judgment means which judges whether it is the fiinction in which the fiinction 
called fix}m the program was specified as an assignment means by which a user's permission 
specifies a required fiinction as the activation, by said assignment means, The 2nd judgment means 
which judges whether it was contained in the fimctional Usting shown said fiinction by which call 
appearance was carried out from said program when judged with said fiinction by which call 
appearance was carried out being said specified fiinction by said 1st judgment means, An inquiry 
means to ask a user whether continue said program execution when judged with not having been 
contained in the fimctional Hsting shown said fiinction by which call appearance was carried out 
from said program by said 2nd judgment means, The program execution arrester characterized by 
preparation ******. 

[Claim 4] The judgment process which judges whether the fiinction specified at said assignment 
process is included in the assignment process to which a user's permission specifies a required 
fiinction as the activation, and the fimctional listing shown from the program. The program 
execution prevention approach characterized by including the inquiry process which asks a user 
whether install said program when judged with said specified fiinction being included in said 
fimctional listing at said judgment process. 

[Claim 5] The judgment process which judges whether the fiinction specified at said assignment 
process is included in the assignment process to which a user's permission specifies a required 
fiinction as the activation, and the fimctional listing shown from the program. The program 
execution prevention approach characterized by including the inquiry process which asks a user 
whether start said program when judged with said specified fiinction being included in said 
fimctional listing at said judgment process. 

[Claim 6] The 1st judgment process which judges whether it is the fiinction in which the fiinction 
called from the program was specified as the assignment process to which a user's permission 
specifies a required fiinction as the activation at said assignment process, The 2nd judgment 
process which judges whether it was contained in the fimctional listing shown said fiinction by 
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which call appearance was carried out from said program when judged with said function by which 
call appearance was carried out being said specified function at said 1st judgment process. The 
inquiry process which asks a user whether continue said program execution when it judges that it 
was not contained in the functional listing shown from said program by said function by which call 
appearance was carried out at said 2nd judgment process, it is ****** - the program execution 
prevention approach characterized by things. 

[Claim 7] The program which makes a computer perform the approach of any one publication of 
said claim 4 - claim 6. 

[Claim 8] The record medium which recorded said program according to claim 7 and in which 
computer reading is possible. 



DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention] This invention relates to the record medium which recorded the program 
execution arrester which prevents beforehand a user or program execution dangerous for a system, 
the program execution prevention approach, the program which makes a computer perform that 
approach, and its program and in which computer reading is possible. 
[0002] 

[Description of the Prior Art] Although maintenance of the network (LAN) which connects the 
computer of the premises mutually from early was progressing in large-scale organisms, such as a 
company and a university, since the client/server system of PC base can introduce easily and 
cheaply, also in smaU and medium-sized enterprises, the individual house yard, etc., the network of 
two or more of the computers to hold is progressing quickly in recent years. 

[0003] Moreover, the computer has become rather more common [ being used accessing the 
Internet ] rather than being used by the stand-alone by explosive expansion of the Internet for the 
past several years. Furthermore, connection also becomes less new and not only the number of the 
computer connected to the Internet but the connect time of each computer is always in the 
inclination which increases increasingly recently. 

[0004] However, the data exchange with other computers in a network is one side of the convenience, 
and is also sponsoring the opportunity of best growth to the computer virus which trespassed upon 
the network concerned. The "I love you" virus (correctly worm) which spread in May, last year all 
over the world spreads, while winking through the e-mail system of the Internet, and the total 
amount of the material and immaterial damage which this generated measures, and is not found. 
[0005] 

[Problem(s) to be Solved by the Invention] And although the software for virus detection and 
extermination was also marketed in order to avoid generating of damage by such virus beforehand, 
the detection and extermination by this were surely "followed", and there were troubles, such as 
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that it cannot respond and becoming a "pinching game" with the virus of the new species which it is 
developed one after another and made skill&l, in a strange virus on the principle. 
[0006] That is, by such software, the existence of a code group (pattern) peculiar to a specific virus 
about all the possible locations of viral infections, such as a boot sector, a system memory, a 
partition table, and a fQe, is checked, and a virus is specified from the discovered code group. 
[0007] When the user has neglected renewal of a chart as well as the virus which is not all over the 
chart which matched the virus and the code group of the proper, for example, the strange virus 
which is not discovered and analyzed once until now, even if it is a known virus since it is such a 
principle, it cannot detect and exterminate. 

[0008] Moreover, Mutation Although the virus of the pleiomorphia mold which gets used even to 
which of the gestalt of 4 billion is increasing since the release of Engine (software with which a 
simple virus is easily changed into the implementer of a virus by the pleiomorphia mold), since the 
code group contained in this type of virus is changing jfrom the original thing, the detection and 
extermination by the above-mentioned technique become difficult. 

[0009] Furthermore, the above-mentioned software has the essential problem that a program with a 
certain malice without a virus and great difference is undistinguishable fi-om the program which is 
not so, in that a damage is chiefly given to a user and a system for the purpose of detection and 
extermination of a virus. For example, unless all ActiveX controls which change a dialup place 
fi'eely, and programs prepared in order to automate a setup and modification of a dialup place are 
infected with the virus, activation wiU be permitted similarly. 

[00 10] Based on the security policy for every environment of that, there are some which have 
restricted access to a local resource depending on this point environment. For example, the Java 
applets (i application etc.) performed on VM of Java cannot access the files on the computer which 
operates (for example, telephone directory etc.) at all. 

[00 ll] From a viewpoint of safety, this is the very powerful and positive defense approach, but on 
the other hand it serves as big failure and limit in development of practical application, and has the 
problem that the convenience of a developer or a user is spoiled. 

[0012] This invention aims at offering the record medium which recorded a program dangerous for a 
user or a system or the program execution arrester which can prevent activation of that problem 
part beforehand at least, the program execution prevention approach, the program which makes a 
computer perform that approach, and its program and in which computer reading is possible. 
[0013] 

[Means for Solving the Problem] In order to solve the technical problem mentioned above and to 
attain the purpose, the program execution arrester concerning invention according to claim 1 A 
judgment means to judge whether the function specified by said assignment means is included in 
an assignment means by which a user's permission specifies a required function as the activation, 
and the functional Usting shown firom the program, When judged with said specified function being 
included in said functional listing by said judgment means, it is characterized by having an inquiry 
means to ask a user whether install said program. 

[0014] While being warned to a user of that fact in advance of install about the program which 
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performs processing specified beforehand according to this invention according to claim 1, the 
install concerned is stopped when a user directs. 

[0015] Moreover, a program execution arrester according to claim 2 A judgment means to judge 
whether the function specified by said assignment means is included in an assignment means by 
which a user's permission specifies a required fimction as the activation, and the functional listing 
shown firom the program, When judged with said specified function being included in said 
functional listing by said judgment means, it is characterized by having an inquiry means to ask a 
user whether start said program. 

[0016] While being warned to a user of that fact in advance of starting about the program which 
performs processing specified beforehand according to this invention according to claim 2, the 
starting concerned is stopped when a user directs. 

[0017] Moreover, a program execution arrester according to claim 3 The 1st judgment means which 
judges whether it is the function in which the function called fi-om the program was specified as an 
assignment means by which a user*s permission specifies a required function as the activation, by 
said assignment means. The 2nd judgment means which judges whether it was contained in the 
functional Usting shown said function by which call appearance was carried out fi:om said program 
when judged with said function by which call appearance was carried out being said specified 
function by said 1st judgment means. When judged with not having been contained in the 
functional listing shown said function by which call appearance was carried out fi:om said program 
by said 2nd judgment means, it is characterized by having an inquiry means to ask a user whether 
continue said program execution. 

[0018] When a different function firom having been beforehand shown among program execution is 
called according to this invention according to claim 3, while being warned to a user of that fact, 
when a user directs, the program execution concerned is interrupted. 

[0019] Moreover, the program execution prevention approach according to claim 4 The judgment 
process which judges whether the function specified at said assignment process is included in the 
assignment process to which a user's permission specifies a required function as the activation, and 
the functional listing shown from the program, When judged with said specified function being 
included in said functional listing at said judgment process, it is characterized by including the 
inquiry process which asks a user whether install said program, 

[0020] While being warned to a user of that fact in advance of install about the program which 
performs processing specified beforehand according to this invention according to claim 4, the 
install concerned is stopped when a user directs. 

[0021] Moreover, the program execution prevention approach according to claim 5 The judgment 
process which judges whether the function specified at said assignment process is included in the 
assignment process to which a user's permission specifies a required function as the activation, and 
the functional listing shown firom the program. When judged with said specified function being 
included in said functional listing at. said judgment process, it is characterized by including the 
inquiry process which asks a user whether start said program. 

[0022] While being warned to a user of that fact in advance of starting about the program which 
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performs processing specified beforehand according to this invention according to claim 5, the 
starting concerned is stopped when a user directs. 

[0023] Moreover, the program execution prevention approach according to claim 6 The 1st judgment 
process which judges whether it is the function in which the function called from the program was 
specified as the assignment process to which a user's permission specifies a required function as the 
activation at said assignment process, The 2nd judgment process which judges whether it was 
contained in the functional listing shown said function by which call appearance was carried out 
firom said program when judged with said function by which call appearance was carried out being 
said specified function at said 1st judgment process, When it judges that it was not contained in the 
functional listing shown from said program by said function by which call appearance was carried 
out at said 2nd judgment process, it is characterized by including the inquiry process which asks a 
user whether continue said program execution. 

[0024] When a different function firom having been beforehand shown among program execution is 
called according to this invention according to claim 6, while being warned to a user of that fact, 
when a user directs, the program execution concerned is interrupted. 

[0025] Moreover, a program according to claim 7 is characterized by being the program which 
makes a computer perform the approach of any one pubUcation of said claim 4 - claim 6. 
[0026] According to this invention according to claim 7, the approach of any one publication of said 
claim 4 * claim 6 is read by computer, and is performed. 

[0027] Moreover, a record medium according to claim 8 is characterized by recording said program 
according to claim 7. 

[0028] According to this invention according to claim 8, said approach according to claim 7 is read 

by computer, and is performed. 

[0029] 

[Embodiment of the Invention] The gestalt of suitable operation of the record medium which 
recorded the program execution arrester by this invention, the program execution prevention 
approach, the program that makes a computer perform that approach, and its program on below 
with reference to the accompanying drawing and in which computer reading is possible is explained 
to a detail. 

[0030] Drawing 1 is the explanatory view showing the hardware configuration of the program 
execution arrester concerning the gestalt of operation of this invention. In this drawing, RAM for 
which 103 is used as a work area of CPUlOl in ROM 102 remembered the intercalation output 
program to be for CPU by which 101 controls the whole equipment is shown, respectively. 
[0031] Moreover, HD which memorizes the data with which HDD (hard disk drive) by which 104 
controls the read/write of the data to HD (hard disk) 105 according to control of GPU 101 was written 
in 105 according to control of HDD 104 is shown, respectively. Moreover, FD which can be detached 
and attached and which memorizes the data with which FDD (floppy disk drive) by which 106 
controls the read/write of the data to FD (floppy (trademark) disk) 107 according to control of 
CPU 101 was written in 107 according to control of FDD 106 is shown, respectively. 
[0032] Moreover, the network interface on which it connects with a network through a 
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telecommunication cable 110, and 109 functions the display whose 108 displays various data, such 
as cursor, a menu, a window or an alphabetic character, and an image, as an interface of a network 
and CPUlOl concerned is shown, respectively. 

[0033] Moreover, the mouse with which 112 performs the keyboard with which 111 was equipped 
with two or more keys for inputs, such as an alphabetic character, a numeric value, and various 
directions, for selection of various directions, activation and selection of a processing object, 
migration of cursor, etc. is shown, respectively. Moreover, a bus or a cable for 100 to connect each 
part of the above for the CD-ROM drive with which 114 controls the lead of data [ as opposed to 
CD-ROM113 for CD-ROM which is a record medium with removable 113 ] is shown, respectively. 
[0034] Next, drawing 2 is the explanatory view showing functionally the configuration of the 
program execution arrester concerning the gestalt of operation of this invention, the program 
execution arrester by this invention is specifically explained to be (l) plug-in below " as " (2) -- the 
activation propriety of the plug-in concerned is judged, and when activation is good, application 
(application which serves as a host) which provides the plug-in concerned with various functions 
(service) is realized more. And 200x are a function part realized with plug-in by the application with 
which 20 Ix become the host, respectively among drawing 2 . 

[0035] 200a is the functional listing presentation section which shows the application which serves 
as the host the list of the fiinctions which the plug-in concerned uses just before install of plug-in, or 
starting. Or it shows the Kst of the functions in which it is planned that this plug-in calls firom the 
host concerned at the time of a handshake with a host but is good. Actually, the installer of the 
plug-in concerned wiU perform functional presentation before install, and the body of the plug-in 
concerned will perform functional presentation before starting after install. 

[0036] Moreover, 200b is the functional call section in which call the various functions (for example, 
services, such as fiile reading, file deletion, window generation, and a text output) which a host 
offers according to a predetermined procedure, and processing by each function is made to perform. 
[0037] Next, 201a is the security management section which judges the install propriety and 
starting propriety, or continuation propriety (these are also collectively called activation propriety 
below) before activation of the plug-in concerned, or during activation with reference to the 
functional listing shown firom functional listing presentation section 200a of plug-in. 
[0038] Moreover, 201b is the security policy DB (database) used as the foundation of the judgment 
by security management section 201a which stores a security pohcy. There are a thing for judging 
that activation propriety (install propriety or starting propriety) before activation of (l) plug in and 
a thing forjudging that activation propriety (continuation propriety) during activation of (2) plug-in 
at this security policy. 

[0039] Specifically with the security policy before activation of (l) "when the specific function is 
included in the functional hsting shown firom the plug-in concerned before activation of plug-in It 
asks [ whether the plug-in concerned is installed and ] a user whether start or not." with the 
security policy under activation of (2) "When the function which is not into the fimctional hsting 
which is the above-mentioned specific function during activation of plug-in, and was shown before 
activation firom the plug-in concerned is called, it asks a user whether continue activation of the 
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[0040] Next, 201c is the security policy setting section which stores the set-up information in 
security policy DB201b while receiving a detail setup of the above-mentioned security policy from a 
user. 

[0041] Drawing 3 is an explanatory view which is displayed by security policy setting section 201c 
and in which showing an example of the screen for setting up "the specific function" of the security 
policy of the above (l) and (2). Those to which a possibility of giving a damage to a user and a 
system among the functions with which the plug-in is provided has the application which serves as 
a host in the box 300 of the left-hand side in drawing are enumerated. 

[0042] For example, a system file and other data files may be deleted without a user's permission by 
activation of the plug-in concerned a "deleting file which another program created" (refer to drawing 
3 )-by calling host's fimction case. [ plug-in of a certain mailer ] This may cause the serious 
situations " all of the abnormalities and destruction of a system, and mail have been erased. 
[0043] Moreover, if another program in which a host does not have a concern will be started when 
plug-in "can call another program", it is not known what kind of destructive action the program 
carries out henceforth. Since system information and individual humanity news are stored in 
registry when "registry can be accessed", damage — the individual humanity news (especially 
password) which can change the dial-up connection place which has a system destroyed is stolen — 
may occur. 

[0044] Moreover, also when "e-mail can be sent to the user who is not registered into an address 
book", the individual humanity news of users including a mail address may flow into a strange 
partner. On the contrary, also when "e-mail can be sent to all the users registered into the address 
book", there is a possibility that the damage of a virus may be continuously expanded from an 
acquaintance to an acquaintance so that the example of "I love you" which was much in fashion in 
the spring of last year may show. 

[0045] in addition ■- if transmission places are a large number to some extent not necessarily all 
the users in an address book not but ** -- that with the same risk (like "Melissa", there are some 
which send a self duplicate to the first address of 50 afiairs) it is here all " you may be 
"more than O people" instead. 

[0046] Moreover, since it can also regard as the combination of two functions with transmission of 
the mail to the member which carried out listing of the member from (l) address book, and (2) 
Ustings to transmitting e-mail to all the users in an address book, the above-mentioned expression 
can also be put in another way as "Members can be enumerated from an address book and e-mail 
can be transmitted" etc. 

[0047] however, a known partner - be a strange partner - be " since it will be thought that there 
is no risk if the text and transmission place are shown to a user and it is transmitted in the 
condition as it is in advance of transmission of e-mail (namely, ** to which neither alteration of the 
text nor attachment of a new, file is performed), you may make it except such an exceptional case 
from the above in detail more finely 

[0048] It may be indispensable for many fiinctions shown in drawing 3 not to be accompanied by the 
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always above risk, and to use the function concerned on the purpose of the plug-in. Moreover, if it 
refers to the purpose of plug-in, a user may be able to judge the existence of danger separately. For 
example, if it is plug-in only for only displaying the image file of a certain format, when it is not 
necessary to delete other files clearly and the plug-in concerned is calling the fimction of file 
deletion temporarily, possibility of being infected with a certain virus is high. 

[0049] Then, among the functions to enumerate in the box 300 on the left-hand side of drawing 3 , it 
is dangerous and the check extracts especially only what the need and a user consider in the 
right-hand side box 303 in advance with the right arrow carbon button 301 and the left arrow 
carbon button 302. As the above-mentioned specific function, this drawing is the example which 
specified "e-mail can be sent to all the users registered into the address book." If the O.K. carbon 
button 304 is pushed in this condition, security policy setting section 201c stores the contents of a 
setting in security poUcy DB20 lb. 

[0050] When 20 Id is the activation propriety inquiry section and security management section 201a 
judges with an user validation being required at return and the next based on the security policy in 
security poHcy DB201b to drawing 2 , the dialog for acquiring the check is displayed. 
[0051] Drawing 4 is the explanatory view showing an example of the dialog for checking the 
activation propriety before plug-in activation displayed by 20 Id of activation propriety inquiry 
sections. The function (good [ extracted / in the right-hand side box 303 / firom the left-hand side box 
300 but ]) and match which the user specified on the screen of drawing 3 are shown in this dialog 
among the functional listing which plug-in presented. And although processing which is called 
e-mail transmission to all the users in an address book and which cannot necessarily be said as 
insurance is performed so that this plug-in may be illustrated, the user is asked about whether it is 
still used. 

[0052] in addition - although the dialog of drawing 4 may be displayed any time as long as it is 
before activation of plug-in - reaUstic - (l) - just before install of the plug-in concerned, and/or (2) 
-- it will display just before starting of the plug-in concerned. 

[0053] And when a user pushes the "yes" carbon button 400 by the check in front of install (i.e., 
when a user permits use of the plug-in concerned in spite of warning), 20 Id of activation propriety 
inquiry sections displays a dialog as further shown in drawing 5, and after making it set up 
whether the again same check is also performed just before starting of plug-in, they install the 
plug-in concerned. 

[0054] In addition, when a user pushes the "no" carbon button 401 in the dialog shown in drawing 4 , 
install displays the message of "having stopped install of plug-in", without carrying out. 
[0055] Moreover, when the "yes" carbon button 500 is pushed in the dialog shown in drawing 5 (i.e., 
when it is set up so that it may also check just before starting), whenever plug-in installed after this 
is called by that host, the same dialog as drawing 4 comes to be displayed. 

[0056] And when the "yes" carbon button 400 is pushed in the dialog of this drawing displayed just 
before starting, the plug-in concerned is started, without displaying the dialog of drawing 5 . 
Moreover, if the "no" carbon button 401 is pushed here, starting of plug-in will not be performed but 
will display the message of "were not able to start plug-in" instead. 
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[0057] Moreover, drawing 6 is the explanatory view showing an example of the dialog for checking 
the activation propriety during plug-in activation similarly displayed by 20 Id of activation 
propriety inquiry sections. This dialog is displayed at any time, when the function which is not into 
the functional hsting which is the function which the user specified on the screen of drawing 3 
during activation of plug-in, and was shown before activation is called. 

[0058] Only according to the check before the activation by the security policy of (1) mentioned 
above (just before install or starting), when infected with the virus which plug-in can show the 
functional listing of camouflage, a monitor will be able to be easily escaped by not notifying a 
dangerous function. Then, also while performing whether the function which differs from having 
been shown before activation by the above-mentioned (2) security policy is called, it monitors 
continuously. 

[0059] In the example of drawing 6 , although e-mail transmission to all the users in an address 
book was not notified in advance, activation of the above-mentioned function will be suspended by 
the display of the above-mentioned dialog during activation of the plug-in concerned temporarily, 
and, so to speak, it will be stopped at the water's edge. 

[0060] In. addition, the user who received warning by the dialog of drawing 6 can perform processing 
shown in the dialog as it is by carrying out the depression of the "continuation" carbon button 600, if 
it judges that it is satisfactory. Moreover, when it judges that there is a certain risk, activation of 
this plug-in can once be interrupted for carrying out the depression of the "termination" carbon 
button 601, and the measures of reconfirming the source of plug-in can be taken. 
. [0061] But if it is planned to say that no doubtful plug-in which calls the function which has not 
been notified in advance is used, the plug-in concerned is directly uninstallable from the dialog of 
this drawing by carrying out the depression of the "uninstallation" carbon button 602. 
[0062] If 201e is the system-protection section and the call of one of functions is received from the 
functional call section 200b during activation of plug-in to drawing 2 at return and the next, it will 
be asked to security management section 201a whether the function concerned is what activation is 
permitted without an user validation. 

[0063] And when activation is permitted under the above-mentioned (2) security policy (i.e., when 
the function concerned is notified in advance), system-protection section 20 le is directed to one 
which provides plug-in with the function concerned of function parts (after- mentioned), and makes 
the demanded processing perform. 

[0064] Moreover, when activation of the function concerned is not permitted (i.e., when the function 
concerned is not what was notified in advance), a dialog as shown in drawing 6 is displayed by 20 Id 
of activation propriety inquiry sections which received the directions firom security management 
section 201a. And when "continuation" carbon button 600 is pushed in this dialog as mentioned 
above, system-protection section 201e is directed to one which provides plug-in with the 
above-mentioned function of function parts (after-mentioned), and makes the demanded processing 
perform. 

[0065] 201f-201i are function parts to which they provide drawing 2 with various kinds of functions 
(service) to plug-in next, and the file reading section which offers 20 If of services of file reading to 
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return, the file cutout which offers 20 Ig of services of file deletion, the window generation section 
which offers 20 Ih of services of window generation, and 20 li are the text output section offered in 
service of a text output. In addition, although much functions offered exist besides what was hung 
up above, illustration is omitted in this drawing (for example, registry access, e-mail transmission, 
etc.). 

[0066] Next, drawing 7 * drawing 9 are flow charts in the program execution prevention system 
concerning the gestalt of operation of this invention which show the procedure of program execution 
prevention processing. The termination of install of a program (in this case, plug-in) and drawing 8 
prevent the termination of starting of a program (this left), and, as for drawing 9 , drawing 7 
prevents program execution respectively dangerous as a result by interruption of the program 
under activation (this left). 

[0067] In addition, in advance of initiation of processing by the flow chart of this 7- drawing 9 , the 
security policy before activation and under activation shall be beforehand set as security policy 
DB201b by security policy setting section 201c. 

[0068] The procedure of the program execution prevention by the termination of install first shown 
in drawing 7 is explained. Functional listing presentation section 200a of plug in presents the list of 
the fimctions which the plug-in concerned calls and uses in advance of install of the plug in 
concerned to the apphcation which serves as the host (step S701). 

[0069] While the application which serves as a host receives the above-mentioned list by that 
security management section 201a, with reference to the security policy in security policy DB201b, 
an user validation judges whether it is the need to install of this plug-in (step S702). if it specifically 
checks and includes whether the function specified beforehand is included during the shown fist a 
check important point ■■ if not contained -- a check suppose that it is unnecessary. 
[0070] And if the user validation is required (step S702: Yes), a dialog as shown in drawing 4 by 
20 Id of activation propriety inquiry sections is displayed (step S703), and when the "yes" carbon 
button 400 is pushed in the dialog of this drawing, (step S704:Yes) and a dialog as further shown in 
drawing 5 will be displayed (step S705). Then, it carries out usually through install of the plug-in 
concerned (step S706), and processing by this flow chart is ended. 

[0071] Moreover, instead of performing (step S704:No) and install, when the "no" carbon button 401 
is pushed in the dialog of drawing 4 , the message of the purport which stopped install is displayed 
(step S707), and processing by this flow chart is ended. 

[0072] The procedure of the program execution prevention by motive termination shown in drawing 
8 below is explained. If plug-in is called firom the application which serves as the host, the 
fiinctional listing presentation section 200a will show the Ust of functions which is planning use 
(step S801). In a host, an user vaUdation judges whether it is the need in advance of starting of this 
plug-in by that security management section 201a (step S802). 

[0073] When the fimction beforehand specified in the functional listing which is the dialog (step 
S705 of drawing 7 ) of drawing 5 at the time of install, and is the case where it is set up so that it 
may also check again just before starting, and was specifically shown above is included, it judges 
with an user validation being required (step S802: Yes). And it directs in 20 Id of activation 
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propriety inquiry sections, and a dialog as shown in drawing 4 is displayed (step S803). 
[0074] If the "yes" carbon button 400 is pushed in this dialog (step S804: Yes), it will start usually 
through plug-in (step S805), and if the "no" carbon button 401 is pushed (step 8804^ No), after 
displaying the message of the purport which stopped starting of plug-in (step S806), processing by 
this flow chart is ended. 

[0075] The procedure of the program execution prevention by activation interruption shown in 
drawing 9 below is explained. System-protection section 20 le directs that there is a call of a 
function from functional call section 200b of plug-in to the application which serves as the host to 
security management section 201a, and it is made to judge whether the function concerned is what 
may be performed without an user validation (step S902). (step S901) 

[0076] Security management section 201a is the function in which the function concerned was 
beforehand specified by security policy setting section 201c, and when it differs firom the function 
shown before activation (just before install and/or starting), it judges with an user validation being 
required (step 8902' Yes), and it is directed in 201d of activation propriety inquiry sections, and a 
dialog as shown in drawing 6 is displayed (step 8903). 

[0077] And if processing called when "continuation" carbon button 600 was pushed in this dialog 
(step 8904: Yes) is performed, i.e., activation of plug-in is continued as it is (step 8905) and the 
"termination" carbon button 601 is pushed (step 8904^ No, step 8906:Yes), while interrupting 
activation of plug-in at that time, that fact will be displayed by the message (step 8907). 
[0078] Moreover, if "uninstaUation" carbon button 602 is pushed (step 8906: No), aifter uninstalling 
the plug-in concerned (step 8908), processing by this flow chart will be ended. 

[0079] In addition, when the function specified beforehand is included in the shown functional 
listing, or when [ although it waited for directions of a user with the gestalt of operation mentioned 
above and an install termination, a starting termination, or activation interruption was carried out 
or ] the function in which there is nothing into the functional listing shown beforehand is called, 
directions of a user are not waited but it may be made to carry out a termination and interruption 
compulsorily. 

[0080] Moreover, although a setup of whether it checks to a user by the functional unit which a 
program uses, or not to carry out was performed with the gestalt of operation mentioned above 
( drawing 3 ), you may enable it to set up whether it checks for every program, or it does not carry 
out. For example, the management person in charge specifies plug-in beforehand, and when the 
other plug-in becomes installed, you may make it display warning Uke drawing 4 so that dangerous 
plug-in (plug-in which it is not in the law of a source) may not be easily introduced by other users 
when one PC is being used by two or more persons. 

[0081] In addition, the program which realizes each above-mentioned function part can be stored in 
various record media, such as FD107 besides HD105, CD-ROM113, or MO, and can be distributed 
with the record medium concerned. Moreover, distributing through a network is also possible. 
[0082] In addition, security management section 201a shown in drawing 2 is equivalent to the 
"judgment means", "the 1st judgment means", and "the 2nd judgment means" which are said to a 
claim, and the processing to perform is equivalent to the "judgment process", "the 1st judgment 
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process", and "the 2nd judgment process" which are said to a claim so that clearly also from the 
above-mentioned explanation. 

[0083] Moreover, the processing to perform is equivalent to the "assignment process" said at a claim 
at the "assignment means" which security policy setting section 201c says to a claim. Furthermore, 
the processing to perform is equivalent to the "inquiry process" said at a claim at the "inquiry 
means" which 20 Id of activation propriety inquiry sections says to a claim. 

[0084] Since install and starting of the plug-in concerned are refused according to decision of a user 
when the function in which there is a possibility of giving a damage to a user and a system is 
included in plug-in according to the gestalt of operation of this invention, as explained above, the 
damage which may be produced as a result of performing the plug-in concerned is beforehand 
avoidable. 

[0085] Moreover, since the credibility is continuously monitored also during activation, without 
trusting easily the functional listing shown before activation, plug-in which it is going to call 
secretly while performing the dangerous function which has not been notified in advance can be 
stopped just before the function concerned is called. The effectiveness brought about by this is the 
same as that of the above. 

[0086] And since the activation can be prevented if it does not ask whether this invention is the 
program created with whether it is the program infected with the virus on the principle, and a 
certain maUce but dangerous actuation is carried out for a user or a system, the usual program 
which was difficult for indication, and a program with the malice which distinction does not attach 
are also easily detectable with the conventional technique. 

[0087] Moreover, even if it is the virus of the pleiomorphia mold which is increasing in recent years, 
as long as the processing made into the purpose is the same, it has the features that it is detectable 
irrespective of the difference in an external code. And the activity which does not need to prepare 
the virus definition file (it is called a pattern file, a DAT file, etc.) which covered the code group of aU 
viruses, and updates the file concerned fi^equently for the detection is also unnecessary. 
[0088] Moreover, without requiring long duration like the conventional virus scan, since this 
invention prevents program execution by very simple judgment [ say / whether a thing dangerous in 
the function which is a call schedule as mentioned above is contained, or the actually called function 
was notified in advance ], it is enforced strictly reasonable every day and there is also a realistic 
merit that effectiveness can be planned. 

[0089] Moreover, since the function which can be used like Java of the conventional technique is not 
restricted uniformly, the degree of freedom of a program is able to aim at coexistence of increase, 
safety, and convenience. 

[0090] In addition, especially with the gestalt of operation mentioned above, activation propriety 
was judged about plug-in in the application which serves as the host in the program, and it is also 
possible to apply this invention, for example to the relation between a macro and the application 
concerned which carries out macro operation. 

[0091] Moreover, this invention is applied between general applications and OS's, namely, the 
function of interruption of the program under the termination of install of a program, a motive 
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termination, or activation can also be given to the OS itself. By this, it will be equivalent to 
introducing antivirus software etc. separately, or the safety effectiveness beyond it will be acquired. 
[0092] Drawing 10 is the explanatory view showing typically how activation of application is 
prevented, when OS is made to possess the program execution prevention function by this invention. 
This drawing shows the example interrupted when the application to which install and starting 
were once permitted calls during activation the file Delete function which is not during the 
above-mentioned Ust by presentation of the functional listing of camouflage. 
[0093] 

[Effect of the Invention] As explained above, invention according to claim 1 A judgment means to 
judge whether the function specified by said assignment means is included in an assignment means 
by which a user's permission specifies a required function as the activation, and the fianctional 
listing shown from the program. Since it had an inquiry means to ask a user whether install said 
program when judged with said specified function being included in said functional listing by said 
judgment means About the program which performs processing specified beforehand While being 
warned to a user of the fact in advance of install, the install concerned is stopped when a user 
directs. By this The effectiveness that the program execution arrester which can prevent program 
execution dangerous for a user or a system beforehand is obtained is done so. 

[0094] Moreover, an assignment means by which invention according to claim 2 specifies a function 
to grant [ of a user ] a permission as the activation, A judgment means to judge whether the 
function specified by said assignment means in the functional listing shown fi'om the program is 
included. Since it had an inquiry means to ask a user whether start said program when judged with 
said specified function being included in said functional listing by said judgment means About the 
program which performs processing specified beforehand While being warned to a user of the fact in 
\ advance of starting, when a user directs, the starting concerned is stopped and the effectiveness 

that the program execution arrester which can prevent dangerous program execution beforehand 
for a user or a system by this is obtained is done so. 

[0095] Moreover, an assignment means by which invention according to claim 3 specifies a function 
to grant [ of a user ] a permission as the activation, The 1st judgment means which judges whether 
it is the function in which the function called from the program was specified by said assignment 
means. The 2nd judgment means which judges whether it was contained in the functional listing 
shown said function by which call appearance was carried out firom said program when judged with 
said function by which call appearance was carried out being said specified function by said 1st 
judgment means. An inquiry means to ask a user whether continue said program execution when 
judged with not having been contained in the functional listing shown said function by which call 
appearance was carried out fi:om said program by said 2nd judgment means. When a function 
which is different fi-om having been beforehand shown among program execution by that of 
******** is called While being warned to a user of the fact, when a user directs, the program 
execution concerned is interrupted. By this The effectiveness that the program execution arrester 
which can prevent beforehand activation of the problem part of a program dangerous for a user or a 
system is obtained is done so. 
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[0096] Moreover, the assignment process to which invention according to claim 4 specifies a function 
to grant [ of a user ] a permission as the activation, The judgment process which judges whether the 
function specified at said assignment process in the functional listing shown from the program is 
included, Since the inquiry process which asks a user whether install said program was included 
when judged with said specified function being included in said functional listing at said judgment 
process About the program which performs processing specified beforehand While being warned to 
a user of the fact in advance of install, the install concerned is stopped when a user directs. By this 
The effectiveness that the program execution prevention approach which can prevent program 
execution dangerous for a user or a system beforehand is acquired is done so. 

[0097] Moreover, the assignment process to which invention according to claim 5 specifies a function 
to grant [ of a user ] a permission as the activation, The judgment process which judges whether the 
function specified at said assignment process in the functional listing shown fi-om the program is 
included, Since the inquiry process which asks a user whether start said program was included 
when judged with said specified function being included in said functional listing at said judgment 
process About the program which performs processing specified beforehand While being warned to 
a user of the fact in advance of starting, when a user directs, the starting concerned is stopped and 
the effectiveness that the program execution prevention approach which can prevent dangerous 
program execution beforehand for a user or a system by this is acquired is done so. 
[0098] Moreover, the assignment process to which invention according to claim 6 specifies a function 
to grant [ of a user ] a permission as the activation. The 1st judgment process which judges whether 
it is the function in which the function called firom the program was specified at said assignment 
process. The 2nd judgment process which judges whether it was contained in the functional listing 
shown said function by which call appearance was carried out fi-om said program when judged with 
said fimction by which call appearance was carried out being said specified function at said 1st 
judgment process. The inquiry process which asks a user whether continue said program execution 
when it judges that it was not contained in the functional listing shown firom said program by said 
function by which call appearance was carried out at said 2nd judgment process. When a function 
which is different from having been beforehand shown among program execution by ****** is called 
While being warned to a user of the fact, when a user directs, the program execution concerned is 
interrupted. By this The effectiveness that the program execution prevention approach which can 
prevent beforehand activation of the problem part of a program dangerous for a user or a system is 
acquired is done so. 

[0099] Moreover, since invention according to claim 7 makes a computer perform the approach of 
any one publication of said claim 4 - claim 6 The approach of any one publication of said claim 4 - 
claim 6 is read by computer, and is performed. By this The effectiveness that a program dangerous 
for a user or a system or the program which can prevent activation of the problem part beforehand 
at least is acquired is done so. 

[OlOO] Moreover, since invention according to claim 8 recorded said program according to claim 7, 
said program according to claim 7 is read by computer, and is executed, and it does so the 
effectiveness that a dangerous program or the record medium which can prevent activation of the 
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problem part beforehand at least is obtained by this for a user or a system. 



DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing l] It is the explanatory view showing the hardware configuration of the program 
execution arrester concerning the gestalt of operation of this invention. 

[Drawing 2] It is the explanatory view showing functionally the configuration of the program 
execution arrester concerning the gestalt of operation of this invention. 

[Drawing 3] It is the explanatory view showing an example of the screen for setting up the detail of 
a security poHcy displayed by security policy setting section 201c. 

[Drawing 4] It is the explanatory view showing an example of the dialog for checking the activation 
propriety before plug-in activation displayed by 20 Id of activation propriety inquiry sections. 
[Drawing 5] It is the explanatory view showing an example of the dialog for setting up whether 
activation propriety is checked also just before starting of plug-in displayed by 20 Id of activation 
propriety inquiry sections. 

[Drawing 6] It is the explanatory view showing an example of the dialog for checking the activation 
propriety during plug-in activation displayed by 20 Id of activation propriety inquiry sections. 
[Drawing 7] It is the flow chart which shows the procedure of the program execution prevention 
processing by the termination of install in the program execution prevention system concerning the 
gestalt of operation of this invention. 

[Drawing 8] It is the flow chart which shows the procedure of the program execution prevention 
processing by starting termination in the program, execution prevention system concerning the 
gestalt of operation of this invention. 

[Drawing 9] It is the flow chart which shows the procedure of the program execution prevention 
processing by activation interruption in the program execution prevention system concerning the 
gestalt of operation of this invention. 

[Drawing 10] When this invention is appUed to OS, it is the explanatory view showing typically how 
activation of application is prevented. 
[Description of Notations] 

100 Bus or Cable 

101 CPU 

102 ROM 

103 RAM 

104 HDD 

105 HD 

106 FDD 

107 FD 

108 Display 

109 Network I/F 
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110 Telecommunication Cable 

111 Keyboard 

112 Mouse 

113 CD-ROM 

114 CD-ROM Drive 

200a Functional listing presentation section 

200b Functional call section 

201a Security management section 

20 lb Security poUcy DB 

201c Security policy setting section 

20 Id Activation propriety inquiry section 

20 le System-protection section ^ 

20 If File reading section 

20 Ig File cutout 

20 Ih Window generation section 
20 li Text output section 



* NOTICES * 

JPO and INPIT are not responsible for any 
damages caused by the use of this translation. 

1. This document has been translated by computer. So the translation may not reflect the original 
precisely. 

2. **** shows the word which can not be translated. 

3. In the drawings, any words are not translated. ^ 
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mfy^'-fycomm'^rcimn^K, ^<D-fy7.h- 
iV^'S'PBmms. fesi^aai^Rrs axTT-i±<in& 

[0 0 3 8] Sfc^ 2 0 1 b{i-b+iLU-r'<-mSgi52 0 

dtD-b^^^aU-r-r^KUv'-ttt. (1) 
^»oJ5) m>m-t^rctb(Di>(Dt. (2) -/^if-^y 

[0 0 3 9] ( 1 ) (Omrm^D-il^^ y X 40 

^fecD-pfeSo 50 
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[0 0 4 0] Offfcx 2 0 1 c{i±ie-ll+aUT>f jKU 

[0 0 4 1] msii. ■t^zLVT'-fr^viy-m^^zo 

1 cti:<fel3g^^ns. ±fB (1) (2) (D-t^:iV7' 
It. *X h * 5 T-/ y -Jr-i/ 3 y !f)^^<0 7^9 ^-f ^ic 

[0 0 4 2] rct^im?>:^~^~(0-f^if^yi}\ .t^ 
/c7r'i';l/^iiJ^T't-Sj (03#M) ^ST"^ 

- 7 r y'cDFF Ri^ <w]mnrL^^ 
[0 0 4 3] $fc. f^^-(yif' m<^-rrif=yK^n 
ytT^-bxT-tsj ixi/"xhyfca>'7.xi>if 

•So 

[0 0 4 4] ^fc. rr HbXi|itSS?nTl/^*l>:i 

i;i6 -r a— If ©fi A1t?BA^*a]©ffi^tc?^t 
aibTL*5Rltgl4*^S^o jMfc, rrFi^xiiitg^ 

yp^SJcAgPiRLfc r I love y 0 

[0 0 4 5] ^fe. sim^tafesss^^T'fentfs 'ij> 

fei) ( TMe 1 i s s aj ft?7](D5 0frO7 

[0 0 4 6] $fc. 7 Klx-Xifii^©^:!— y'fcy-;!/* 

3M<i-r§i:ti. (1) TYV7.m-^^(n>i^y>'^mw 
mm(Dm^'^t^-ii:t^^cti>xt^<Dx\ ±m(Dmm. 

[0 0 4 7] /cfcbKa<Offi^T'Sn5SS]<7)ffi^r-fe 
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[0 0 4 8] B3{c^-rBma#lc±iEiOj;^^feg^ 

[0 0 4 9] ^(1T% S3©£{|[|tD4-:-y ^^Xa 0 Ofc^iJ 
$5En^t^^ y 3 0 2 fc :feil«D.t*'y 3 0 3 tcatti U 

Tfe< o |wi0a±fe#Sco^tgi: LT. rr F bXilit 20 

tSj ^mSLfcfi^T'SSo <l©t^^-eOK.-K^y3 0 

4*w^n^i!. -b^aUx^-^Uiz-ssgpa 0 1 

c ttiSSf*3g«:-b:^^a. ij -r ^' U i/- D B 2 0 1 b 

[0 0 5 0] 02lcMDs o^t2 0 1 d«*fTRrSP.g 
t^^tJ^i-gPT'^D^ ■t4^aLUx^'^ag|5 2 0 1 aA^-tr4^ 
aU7'i':t>Ui^^DB 2 0 1 b p^O-t+a U T^-f ^KU 

[005 1] 0 4 (i. ^tTRlSPtgt^-&^:)-ligi5 2 0 1 d 

<fc I? wr<^ . ymmic^o^mn'si^^m. 

^L-^fjm 3 ©fflST'Ji^ L/c 3 0 0 

i)^ 6;&ffl[|©jK >y ^ X 3 0 3 fcfl&tii Lfc> V o T J; 

I/O iitgi:-a'r^t>®*%?nTi/^§o ^lt. 

[005 2] ^43. 0 4©^V7D^^{i:/^^^-r>C[)5l 

a (1) aM7'^y'Yvc)'f'yxh-;biIt5. fej;aV 
s/ca (2) S^T'^^'Vyogifiiltufca^-rsci: 

[0053] ^LT. -YVX h-;l/aM®6t^T'i-if 
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5fc^-rJ:3ft^-rTD^^;gr«^LT> f^if^:/<om 
[0 0 5 4] ^fc. @4{i:5^-r^'VTPi'*-ea— >f*^ 

[0 0 5 5] ^tz. m5KfF.ir^^7u^X' rttv>j 

^y 5 0 Qii^WT-^titcm^. trs.t>%imm.m\c^m 

nfc y-r >/b^^<o*; X h ?> pft>*/±i ? IP 

[0 0 5 6] *LTs mmmmcm^s nfzmm(D^-f 
TP^-r- ^^i^,^J 4-s^'y4 oo*WT*nfc«-&tctt. 

[0 0 5 7] Sfc. 06ttllC<llfT"ri5Hgt/^-&^3-li:a5 

2 0 1 dtc.fc'jgg^^n^. 7'^i'V:/^ift|'fc^©^ 

[0 0 5 8] ±^Uft (1) ©-b+a'jT^^^t^'Ji^-fc 

S!f£itT'«. i^-f yi^^^o^wm-n^mmr' t s 

T'±M (2) (D-lr+aUxi'.1^U>'-{c±0. HfTHuf;: 
[0 0 5 9] 06©M-C-{±. T Kl/Xi|irt(D^a— 

[0 0 6 0] ft:j3> m6(0^^Tti^ici:^m^^^iy 

^ Lfc t (i. rttiihj y 6 0 1 T^T § 
-5, 

[0 0 6 1] toilfe. «tu{c*^LTi/^^l/>^|g^[¥ 

:?5r$fT'^ntf, rr y-r yx h .1?^? v 6 0 2 ^jf 
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[00 6 2] 02fc^l3. -D^lzZO 1 ettv-XrA^ 
[0 0 6 33 ^LT±3S (2) ©■tr^^iUxf'.-i^Uv'- 

0 1 & ii^mwm^y'7^-(y\zmm^\^^-fnti^(r>m 

[0 0 6 4] ^KIitl<OllfT)b^?FRr*nftV^« 
•b+n.';-r'rWaai5 2 0 1 a7b^e.<0fg^%§tt 

ciD^^"^7P^r- r^Mj ^-^y^ootm'Ttnrch 

[0 0 6 5] mZKmKf. -D^lcZO 1 f~20 1 iti 

f^^-fyicjcivr^mcomm (-9— ifx) ^mm^ 
mm^T&^s 20 1 f «:7r-t';i/^*tji*i©-9--ex 
^^t^yr^jitm^y^^^. 2 0 1 g{i>'T'<;i/iiJ 

m(DV—\£7.^m^-r^yr'{)mm^. 2 0 1 ha"? 

2011 {ir+Xhtti:^)©-^- ex^s^-r^sx^x h 

X. ;)<-;l/jiM^if) ^ l^0T'a0^^^liiSLro>5o 
[0 0 6 6] 07~gI9(i*?gB^©||S|©Jg^ 
^^:A^A^§:/Dif^A||^fEJl±>'XxA^i:fe^t?>> 

miiif^^^i. (ccDm-^ii-f^^^y) <D-^yxh 

[006 7] ra7~H9©7P-^+-h{cJ;§ 
5!ia©F»iJi&k:^fei[o T. -t^o. U xi' ^i?U v'-D B 2 0 
1 bfca-b4^rLUr'i'iKUv'-iaSa52 0 1 cfc<fcO, 

[0 0 6 8] *-r07fcg^f, •Y>'Xh-;l/04'±fc<t 

>©®Hg-MS^g|5 2 0 0 a a, SKT"^ i'V y©'!' 
>Xh-;l/fc5ts5:oT^ ^■©i^xX^i;S:S7':/y'^— > 
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^<D~n^m.7r<t^ (Xx-vT'S 7 0 1 ) o 
[0 0 6 9] .tvXh^*57:/'jy— >3>tt. ±fB- 
M*^©-t^aUx'rWaa52 0 i aT'§M1-?.i:i:fe 
fc^ •b4^aUT-<3}?U'>-DB 20 1 bF^©-b4^ay'r 
^'jKU>'-^#BiLT. (i©y^i^-Y>©'<>'Xh-;l/ 
fcn— tf ©5tEA^'^S*^H a *^^*iJ^-rs (Xx>y ^ S 
7 0 2) o fti^Wfctt, S^^n/'c-M^fcfe&A^Dii) 

■So 

Co 0 7 0] ^Lx. n.— tf©6t^^je®-efenjf (x 

■r-y:/S 7 0 2 : Y e s) . ^fTRrSP^t/^-&t)^a? 2 0 
1 dJcj;»3a4{c^Lfc<td*^-f'TPi^%«^L (X 
x>v:/S 7 0 3). mm<D^-^7ti^X r«i,>j 
4 0 OA^JfT^n/cilta (Xx-y:/S 704 : Y e 
s) s ?^lc05lc^Lfc<t3S:?V7P^'*^^-r5 

(XT'y^S 7 0 5) o ^©m. s^:/^^^-ry©'<y 

Xh-;U^a^a»)fc<l^oT (Xx-y:/S 7 0 6) > 

20 *:7P-f-^'-htc<ts®a^^7-r-5o 

[0 0 7 1] $fc. 0 4©:Jf-r7'p^*r' ri,>t,>^j .t>^f 

y 4 0 1 *^ff"F^ nfcilttt (Xx>y:/S 7 0 4 : N 

o) . -i'yxh-;i'%*5ii:&dftt)'3{c. -ryxh-;v 

^ff±Lfcg©>< -y-tz-i^^^^LT (Xt--v7°S 7 0 
7) . *7P-^-V-hfcct§S!ia^i^7-r5o 
[0 0 7 2] ■ommslc^T. mWl<D'P±lc^:^fti 

^^i.mnm±(Dmmc-oi^rmmt^o f=y y\t 

i:. ^©«lti-^Sg^a52 0 0 at j; »). ■(Iffl^^^L 

30 Tt,^^^tg©-K>^^^-rS (Xx>v7°S 8 0 1) o 't^ 
XH?a^©-fe::^iUxi'Sag|52 0 1 a{c<fci3. c© 
7^ >'©ei!)lc^feS:^ r^— If ©5ti:*^£^S*^ if ^ 
. ^^^W^-rs (Xr-yT'S 8 0 2). 

[0 0 7 3] "mmat. VVX h-;b^©05©^V 
rp^/* (07©X'r«v7'S 7 0 5) T% SSjStttcfeff 

Sf^ (Xx>y:/S 8 0 2 : Y e s) o ^UTUffRlS 
40 P.ai/^-&t)Hi:gp2 0 1 dfclt^Lr. 04fc^Lfci:'5^ 
^VTP^^-^S^^-tt-S (Xx^y^S 8 0 3). 

[0 0 7 4] ccD^-iTu^'x ^^i^,^J 4 o o*^ 
JTF^n^i; (Xx-y7'S 80 4 : Yes) . 
y^S#®t)^i!)L (xx>y:/s 8 0 5) s ^^^^^^J 

4 0 1 :6^}fT?n^ t (Xx-yT'S 8 0 4 : N 
o) . 75^V>©fii!j*4'±L/cg©><>y-t-i^'%a 
^ (Xx'y:^S8 0 6) bfc^, ;$:7P-^^-hK:i 

[0 0 7 5] O€t09t:^-r. lltfff'»rfci:S:/Pi^ 

50 ^AiifTi»±©Wiot/^T»iBj-r§„ -^^f^yo^m 
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9 0 1), i/X7-L^m32 0 1 e {±-b+a. 'Jxi-gS 

gp 2 0 1 a Km^hx. mwimmif)^:3-~'^(omm^ < ^ 

:/S 902) c 

[0 0 7 6] -b4^aUr'rWag|52 0 1 att, ^K^tS 
*^-fe:^ra'J'r^':iKU->-^a52 0 1 c fc<t^Dfe?»b^L; 

2 : Y e s) , mf^^Sm^^-^ti-^^Z 0 1 dfcJi^L 
>;':/S 9 0 3) o 

[0 0 7 7] ^LXs C<0^-(7t3ifX mui ty^y 
6 0 Oif-WT-^n^t (.:^7-yfS 9 0 4 : Y e s) P? 

■^^(D^t^mUL (Xr-y/S 9 0 5). rifj±j 
>6 0 l*^}fT*n5fc (XT>y::/'S9 04 : No, X 
■T'yfS 9 0 6 : Y e s) > ^tD^#,T':/7i7V>£D^ 

t?> (xxyt/sgo?) o 
[0 0 7 8] rTy-Yyxh-;i/j t'^ye o 2 

*WT?n5i: (Xx>yyS9 06 :No) . S^^^ 
^j^-ry^Tv-f yxh-;!/ (X-r-y:/S 9 0 8) Lfc 

[0 0 7 9] fs:^. ±mLfcmm<Dmmxii:i-v'(Dm 

[00 80] tk. ±a L fc^S£<7)Jgg|T'{± :/p A 

^^fecftofc*^ (03) , fe5i/^a:/p^^A<r'i:te 

ii^jf— 3©pc^aiS(A-e«fflLTt/>^^-a-. mom 
mmciiOitms:f'y^''^y mm(Dm-b'xts:i^f5'if 

m^mii^h^t^Uidf^^^y^mmLXfs^^ ^ni:X 
n(D-r^ y *V ^x h -;l/*n^ d -p /c ii ^ tc 
0 4 <D J: -5 ^#^*a^-r 5 <t 9 fc LT <fe l\ 
[0 0 8 1] ^43. ±5RiD§^tgg|5;&||]l-r57°Di7'5 
A«> HD 1 0 5(D(i;6^F D 1 0 7. C D-ROM 1 1 
3 fe^ l.^^iM 0 ^ if ©#fflf2il^i<*lcl&i^-r -5 <I ;!)^T- 

[0 0 8 2] ±l3iKflJA^e.feB^6A^*<fc^fC. 0 

2fc^1--b^aUx'C'gagP2 0 1 aJ5)^S*«^c^^^ 
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m^^m 1 ©¥iJ^¥Sj 43 j: 2 ®!|3J^# 

Co 0 8 3] S^fc, ■b+a.'Jx^d<Ui/-g8^giJ2 0 1 
■ SP^v^-&t>-li:^2.0 1 d)b^S*«^c^^5 rp^i/^-^fci*^ 

10 iM\ fcffi^-r^o 

[008 4] &JMm Ufc cfc ^ t*f|^(D*i6S©}g^lC 
J:n{f, 'f-^>'XxAk:$f;»{-e;^#^§:fe^-nfiD 

[0 0 8 5] Sfc. SltTBut^^^nfolftg^K*^^ 

LTv^5fc«>, mi\^^^\.x\.^isi\<^immm^mi 

cinfc J: ») "fc 6 ;J nsa^tt±fB i: ra^^T^fe 
[0 0 8 6] -^-LT. *l80^tt^OliS±. >5^';Vxlc 

30 [0 0 8 7] $fc. ]Bi^mUlLXi^>:h^BWSl<D'^ ^ )l 

f ;l/XcDr3-Fgf^MSUfc'>^';l/X^«77'i';V 
^-yyr-fjW da T7 5'-i';i/&ifi:fei/>^) Affile 

[0 0 8 8] S^c. *fg0^tt±KSO<i:9t. nft/ffib^ 

mmmc^ *j fx3'!f'^K(Dmmm±t^<DX\ 

<Dtf -( ;l/XX^-ir ya^^ o fcg^K^g-T S c i:* < . 

[0 0 8 9] Sfc. $^«e^S<DJ a V aOi^^^:•|^fflr' 
tS^tg^-»^ci^M•r^fe^0T-tt*^>^DT^ ya^T^^ 

[0 0 9 0] **5. ±ML^cllfig<DJg^T'«7'P^*^A 

50 <r>^x%,m^-f'y^^y^-o\,^x. ^^04-^x^i:*^7 
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[0 0 9 1] sfc^ -m(D7:fv^~>'Bytost0 

[0 0 9 2] E 1 0(±. *5l0J{i:j;5:/P^^A^tfl» 
[00 93] 

[0 0 9 4] ^tc. ni^m2Kmm(D^mii. ^(omn 

§ *^S*^^3.-+f tcF^(/^-^b-&;s 
[0 0 9 5] Sfc^ lt*S3fcffim©^HJti. ^©SlfT 
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t;ffi?nfc^tg*^sufByp i'*^ A*^?.s^^nfc<itg- 
K'^^c-§^nT^^fc;b^s*^^l'J^■r 2 cmm-m 
fc. i<rffim2©!pj^^@tcj:Dt>iffiiftfai?n/'catg*^ 
taE:/p y^ A*^ fe^f^^nfcHtg-SEpic^snTv^ 

^fiixfc«7)T\ 7"P^^^A©||fTl'^5.3b^i;46SI^ 

■&fc{iS^:/ny7A©llfi=*^t|JBT*n. eintcio 
T. rL— tf-^v/X-rAfci;c.rfeg^:&7'P^'*^AOP>l^ 
gi5^iOj|fT**^!Sfcl55±-rs C ilTb^Rlte^ft^P ^''^ AH 

[0 0 9 6] Sfc. ff*«4lClH«©^Bmis ^CD^tT 

py7A*>6*l^$n/ctitg-K*tBufBJi«XigT'}i 

- —9'fc^tD»ii*^,^?ns til fete. ^.-HfA^ji^L 

T> ^— f^i/7.-rA(Ct-Drfe^:&:/Pi^'7AcD||ff 

30 [0 0 9 7] $fc. if*«5tCfB«(DfigH^{i. ^^mi 
P i''^ AA^ nfci^tg-^* t MIBJi^XST'ii 

s*nfc«iti)!)^#sns)t>^5)!)^^¥ij^-r«wsxsi:. 

tulBfiJSXSTBufBaHg-K* tulBJgS^ tifcaig*^ 

^$nsj:fijS5nfcii^(c. t3iB:/pyvA^Si&-r 

S*^?5*^;Sr:x— tfJcPcgv^-^tD'^-SP^v^-a-fc-li-Xigi:. ^ 

40 KA^tfJih^n, cntcioT. a.— »f.f>>'X-rAU:i:o 

rfe^^:/p A©iit7^*^tci5Sih-r 5 c A^Rjig 

[0 0 9 8] ^tc. m^mQ\mm<Dmm. t<Dmn 
p i^vA*>6(f i;aj5n^catg*^HuiBfi^xST'ji^? 
fsm 1 <?)fj^xgT'tijfsif i>*ffi$n/c:itg*WB}i^? 

50 *ifigA^Bul3:/p y^A*^5^g^^n/c*itg-Ktf 
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[0 0 9 9] $fc. lf^^7{cfS«®?|BBJ. MIBW* 
31 4 -R^JS 6 ©V ^-rn^^— 3 B«©:^a^ 3 > tf :i 

-^t^ff ^■a:5<Dr\ tfifBS^^ 4 ~^««6 (Ol^-f 

^t\^^r>^M^mt^o 20 
[0 1 GO] ^/-c. lt*«8tfB«©5ilH^{i. MEW* 

[0 2 ] ^mmcommmmic ^)^*^ § :/n AfitTR5 

[03] ■b:^^aUri'jKU>'-^g|52 0 1 ctc<fc5a 

[04] mn'^'sm^^'^tj^k^z 0 1 dfcj;»3a^sn 

[05] HfTBTSF^i/^-^fc-liSPZ 0 1 dtiDg^^n 
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[06] nn'^^m^^'^t^^^zo i dt^^^^^n 

[0 7 ] ^mm^ommoBmic i^^t- 5 A^tf rs 

5 AiitTi5S±®ac>^iii^^-r7P-f-i'- h TfeSo 
[08] :^mm<Dmm(Dmm\ci)-f}-^^'fv^''yi.mn^ 

[0 9 ] *fgB^©*Sg(DJg^(C*^A^S ^P ^'7 AUtTK 
±iyXxAfct3lj-^. ^lT'^»Tfc<fc-S7°P AUtTES 

[01 0] *5gB^^OS^c^5fflLfc^-a•^^:T7■'Jy-v' 

1 0 0 /^xSfctiy— 7;l/ 

101 CPU 

102 ROM 
10 3 RAM 
104 HDD 
1 0 5 HD 

1 0 6 F DD 

1 0 7 F D 

108 r-rxyw 

109 ^yh'y-i^l/F 

1 1 0 Jifi'>--7;i' 

1 1 1 *-4<-F 
1 1 2 

1 1 3 CD-ROM 

1 1 4 CD-ROMF^-fT" 

20 0 a mm-wm^-^ 

2 0.0b mm^zfmi^^ 

2 0 1a -fe^aU-r-rgSgP 

20 1b -b^^aUx-fii^Ui^-DB 

20 1c -b^^cxUT'fJKUv'-ISSgP 

2 0 1 d ^tTRlSPn!l.^^t>-<i-g|5 

2 0 1 e v'XT-A^HgP 

2 0 1 f yT-^jim^)h^^ 

2 0 1 g ^r-TMiJI^gP 

20 Ih '>^'yF'j7^fiKg|5 

20 1 i T'^XhiHtim 
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